Which Sealed Secrets scope allows a sealed secret to be decrypted in any namespace under any name?

By default (strict scope) the ciphertext is bound to the exact name and namespace, so moving the secret breaks decryption. namespace-wide frees the name, and cluster-wide frees both name and namespace at the cost of weaker isolation guarantees.